Provero

Match plus provenance

KYC Data Provenance Review

A match is not proof of a person.

Provero helps KYC, IDV and fraud teams surface breach exposure, impossible chronology and fraud signals in records before they become trusted evidence in downstream workflows. A database match proves records line up. It does not prove the record is fresh, consented, independent, or safe to trust.

Run the API checks yourself or sign up free →

To request a data provenance review, email support@provero.io

What Provero checks

Breach exposure across email, phone, IP, username, domain and password signals

Dead, unreachable or inconsistent phone numbers

IP fraud signals including proxies, VPNs, TOR, bots and abuse history

IP and location mismatches against the claimed identity

Impossible dates and invalid chronology

Supplied name, address, date of birth and age against mobile-network data

How those signals fall across a whole sample, not just one record at a time

Why a match is not proof

A KYC match proves that two records line up. It does not prove that a real, consenting person is behind them. The same identity spine, name, address, postcode and date of birth, can carry completely different origin stories, and the match cannot tell you which one it is confirming.

The same stolen record arriving by many routes looks like corroboration, but it is redistribution. Once a record enters the data ecosystem it is sold, enriched and re-permissioned, so when it later appears in several places, that is often one origin arriving by several routes, not several independent witnesses.

Standard spine-only checks are blind to this by construction. Breach and fraud signals often live in the email, phone, IP, username and password data, which the spine does not include. A clean, compliant match can therefore confirm a breached or recycled record without ever surfacing a risk signal.

A match proves alignment. Provenance helps decide whether that alignment should be trusted.

Why independent identity corroboration matters →

What a data provenance review reveals

A data provenance review reads the tells a spine-only check cannot see. These are examples, drawn from our own anonymised analysis, of the kinds of thing that are catchable, not a how-to.

Extreme breach concentration on a source

A single source running breach exposure above 90%, where a genuinely current, trusted feed sits around 40 to 50%.

Unusually old breach ages

Breaches averaging around nine years old, against around three years in clean data. Recent exposure is ordinary; very old exposure at scale is not.

Impossible chronology

People who appear not to have been born when their data was first breached, which cannot happen for a real human record.

Calendar dates that cannot exist

Date fields such as 30 February or 31 April. Nothing produces those except a generator inventing data.

Dead numbers that are breach-exposed

Phone numbers that are dead yet sit in a known breach, which is strange for supposedly fresh, recently collected traffic.

Inconsistent location signals

IP or location signals that do not line up with the claimed identity.

Breach exposure concentrated where it should not be

Records described as freshly collected whose contact details are already widely exposed, which is hard to square with the story attached to the data.

Each tell is a pattern-level signal, not proof about any single person. A breach rate is a floor, not a ceiling, because it only counts breaches that have been reported and indexed, so the real figure is never lower than the one you see.

Two ways to use Provero

Option 1

Request a data provenance review

Send us a sample of inbound data, supplier data or existing records. We run the live Provero checks across it, read the breach, chronology, phone, fraud and location signals together, and report what we found so you can decide what to trust, challenge, suppress or review.

To request a review, email support@provero.io

Option 2

Run the checks yourself

Use the APIs or bulk upload to run the same signals directly in your own workflow, on every record as it arrives or across an existing dataset.

See the checks you can run →

Run the identity, provenance and fraud checks yourself

Mobile Network Identity Verification, often called MNO KYC, corroborates supplied name, address, date of birth and age against mobile-network data. Run it on its own, or combine it with the data-verification and risk checks below in a single call. All of these run today as a real-time API or a bulk upload.

Mobile Network Identity Verification (MNO KYC)

Pricing and additional country coverage on request

Corroborate supplied name, address, date of birth and other identity details against mobile-network subscriber data, with a result for each field you send.

Explore Mobile Network Identity Verification →

Age Verification API

Pricing and additional coverage on request

Check whether someone meets an age threshold using mobile-network data without requiring them to upload an identity document.

Explore Age Verification →

SIM Swap Detection API

Pricing and country coverage on request: pricing@provero.io

See whether the SIM behind a mobile number changed recently before relying on that number as an identity, authentication or recovery factor.

Explore SIM Swap Detection →

Breach Detection API

from £0.012

Know if an identity is already exposed, check emails, phones, IPs, usernames, domains and passwords against known breach data.

Explore Breach Detection →

HLR Phone Verification API

From £0.0042 per lookup, down to £0.0023 at volume

Know whether a mobile number is real, reachable and which network serves it.

Explore HLR Phone Verification →

Email Verification API

from £0.006

Reach inboxes, not bounces, confirm an address is deliverable before you send.

Explore Email Verification →

IP Fraud Detection API

from £0.02

Spot the fraud before it gets in, proxies, VPNs, TOR, bots and abuse history in a single 0–100 score.

Explore IP Fraud Detection →

IP Geolocation API

from £0.008

Check they are where they say they are, resolve an IP and match it to the address they gave you.

Explore IP Geolocation →

Name Validation API

Free

Catch fake and junk names, flag profanity, gibberish and obviously fake names before they reach your CRM.

Explore Name Validation →

Multi-Validation API

you pay the per-request rate for each check included in the call

Run every check you need in one request and get each check's result back together: one call, every signal.

Explore Multi-Validation →

Where we are heading

We are building towards a single provenance-weighted outcome score that combines these signals automatically, so you read one number instead of assembling the pattern from individual checks yourself.

Today, you can run the individual checks directly or ask us to review the patterns for you. The score is not shipping yet; early accounts will get first access to it as it lands.

Customer feedback

What teams using Provero say

"We tested Provero as an additional layer for our KYC data provenance due diligence and the outcome reports were very insightful. We could identify data that was part of a legacy breach, data that existed on national suppression files along with detailed phone and email validation flags. Really impressive solution and would recommend to anyone onboarding new data or to check existing datasets. It enabled us at Dataxcel to make informed decisions especially around compliance."
Lorcan Lynch, Dataxcel

KYC, IDV & Fraud FAQ

What is a KYC data provenance review?

A KYC data provenance review is an examination of identity records, or of a data source, for signals that a record may be breached, stale or otherwise low-trust before it becomes trusted evidence. Provero runs the live checks across a sample of your inbound data, supplier data or existing records, reads the breach, chronology, phone, fraud and location signals together, and reports what was found so you can decide which data and which suppliers to trust.

What does "a match is not proof of a person" mean?

A database match proves that two records line up. It does not prove that a real, consenting person is behind them, that the data is fresh, or that the sources are genuinely independent. The same identity spine can carry very different origin stories, and the same stolen record can appear through several routes and look like corroboration. A match proves alignment; provenance helps decide whether that alignment should be trusted.

What is match plus provenance?

It means an identity result should carry more than a yes or no match. Alongside the match it should surface the provenance signals: breach exposure, breach age, chronology, reachability, fraud and location signals, so a match can be read as strong evidence, weak corroboration, a risk signal, or not something to trust yet.

Does breach exposure mean a record is fraudulent?

No. Many legitimate people appear in old breaches because they have used the same email or phone for years. Breach exposure is a pattern-level signal, not proof about any single person. It becomes meaningful when breach rates and breach age are extreme, when chronology is impossible, or when it sits alongside other risk signals on the same record. A breach rate is a floor, not a ceiling, because it only counts breaches that have been reported and indexed.

Can Provero replace my KYC or IDV provider?

No. Provero is not a KYC or IDV provider and does not make a final legal determination about a person. It surfaces provenance and fraud risk signals before and around your existing checks, so you can decide whether a record should be trusted, challenged, suppressed or reviewed, and reduce unnecessary downstream calls on records that were never worth them.

Where should identity data be checked?

At the point a record enters your system, where you still hold the full record: email, phone, IP and the surrounding metadata. Breach and fraud signals often live in fields a downstream spine-only match strips away. Once a record is through the door and redistributed across the chain, it is far harder to un-trust it.

How can I tell whether a supplier is feeding me breached or low-trust data?

Request a data provenance review. Provero runs the live checks across many records from that source and reports how much of it is breach-exposed, how old that exposure is, how much is unreachable and how much is chronologically impossible, so you can see what a source is actually sending you.

Can I run these checks by API instead of requesting a review?

Yes. Every signal is available as a direct API call or bulk upload: Breach Detection, HLR Phone Verification, Email Verification, IP Fraud Detection, IP Geolocation and Name Validation, or several together with Multi-Validation. Each returns an individual signal; the value comes from reading the pattern across them.

What signals does Provero use?

Breach exposure across email, phone, IP, username, domain and password signals; phone reachability; email deliverability and risk; IP fraud signals such as proxy, VPN, TOR, bot and abuse history; IP and location mismatch against the claimed identity; name plausibility; and impossible dates and invalid chronology. No single signal is a verdict; the pattern across them is what tells the story.

Is the provenance-weighted score available today?

No. The single provenance-weighted outcome score is on our roadmap, not shipping today. Today you can run the individual checks directly or ask us to review the patterns for you. Early accounts will get first access to the score as it lands.

Find out what your data, and your suppliers, are really feeding you

Request a data provenance review and we will examine your records or sources for breach, chronology, phone, location and fraud signals. Prefer to run the signals yourself? Create a free account and call the checks directly.

Sign up free

To request a data provenance review, email support@provero.io